Home Decisions

Decision 092/2023

Decision 092/2023: Allegations of inappropriate conduct by former First Minister, Alex Salmond

Authority: Scottish Ministers
Case Ref: 202000973

Summary

The Applicant asked the Authority a wide range of questions about contact between Nicola Sturgeon and Alex Salmond, or people acting on their behalf, in relation to complaints that Mr Salmond had acted inappropriately towards Scottish Government staff and other women. The Applicant also asked about any changes of policy or practice whereby female members of staff were not to be left alone with Mr Salmond.

The Commissioner found that the Authority had generally complied with FOISA, but had been wrong to notify the Applicant that it did not hold some information and that some information was otherwise accessible to him. These issues were rectified during the investigation.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1) and (2)(a), (b) and (e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held); 25(1) Information otherwise accessible); 26(c) (Prohibitions on disclosure); 36(1) (Confidentiality); 38(1)(b), (2A), (5) (definitions of “data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)

Contempt of Court Act 1981 (the 1981 Act) section 11 (Publication of matters exempted from disclosure in court)

United Kingdom General Data Protection Regulation (the UK GDPR) Article 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (10), (14)(a), (c) and (d)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendices form part of this decision.

Background

1. On 24 March 2000, the Applicant made 12 information requests to the Authority, focussing on contact between Nicola Sturgeon and Alex Salmond in 2018 and on changes to policy or practice regarding female members of staff being alone with Mr Salmond. The requests are set out in full in Appendix 2.

2. The Authority responded on 19 June 2020. It advised the Applicant that:

some of the information he had requested was already published; it was therefore exempt from disclosure under section 25(1) of FOISA
disclosing some of the information would constitute a contempt of court; it was therefore exempt from disclosure under section 26(c) of FOISA
some personal data could not be disclosed because disclosure would breach the data protection principles in Article 5(1) of the UK GDPR; it was therefore exempt from disclosure under section 38(1)(b) of FOISA
it did not hold some of the information requested; section 17(1) of FOISA therefore applied.

3. On 3 July 2020, the Applicant wrote to the Authority requesting a review of its decision. He was dissatisfied
with the original response because:

the information which had already been published (section 25(1)) was limited and did not fully answer his requests
with reference to the exemptions in sections 26(c) and section 38(1)(b), the Applicant commented that he was not seeking the disclosure of any information which (contrary to the relevant court order) would identify complainers or alleged victims.
he found it difficult to believe that the Ministers did not hold other information.

4. The Applicant also made a further request which is not part of his application, so cannot be considered in this decision.

5. The Authority notified the Applicant of the outcome of its review on 31 July 2020. It upheld its original decision with minor modifications:

it considered it could have explained in more detail why the exemptions in sections 26(c) and 38(1)(b) applied and why it was satisfied that it did not hold certain information (the Authority provided further explanation)
it confirmed it did hold some information which it had previously advised the Applicant it did not hold, but that this information was exempt from disclosure under section 26(c).

6. On 24 August 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant was dissatisfied with the outcome of the Authority’s review because:

he considered the response from the Authority fell well short of fulfilling its obligations under FOISA
he believed more information was held than had been disclosed – he commented, in particular, about the categorisation of meetings as government meetings or political party meetings
in his view, exemptions had been applied too broadly

Investigation

7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.

8. The Authority was notified in writing that the Applicant had made a valid application.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions.

10. The case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. He has endeavoured to give as full account of his reasoning as he can, but, as recognised by Court of Session in Scottish Ministers v Scottish Information Commissioner :

in giving reasons for his decision, [the Commissioner] is necessarily restrained by the need to avoid, deliberately or accidentally, disclosing information which ought not to be disclosed

12. During the investigation, the Authority disclosed some information to the Applicant and advised the Commissioner that it wished to change its approach to some of the requests. A further response was sent to the Applicant (5 October 2021). However, the Applicant confirmed that he wished to wished to proceed with his application.

Decision 102/2020

13. On 2 September 2020, just over a week after the Applicant made his application to the Commissioner, the Commissioner issued Decision 102/2020. This considered an information request (from a different applicant) for details of the contact between Ms Sturgeon and Mr Salmond in 2018. That decision (see, in particular, paragraphs 40 to 51) considered whether the communications which had taken place related to purely party business or to government business and whether they were held by the Authority for the purposes of FOISA.

14. For the reasons set out in that decision, the Commissioner was satisfied that information which the Authority had previously argued it did not hold, was in fact held for the purposes of FOISA.

15. Although the Authority appealed Decision 102/2020, it accepted the Commissioner’s finding that the information in question was held by it for the purposes of FOISA.

16. The Authority noted the substantial overlap between requests 1 to 10 in this case and the requests which were considered in Decision 102/2020. It noted that, having made submissions to the Commissioner in that case, the Commissioner had raised supplementary enquiries (28 November 2019) which led to it undertaking further searches, and which led to the Commissioner being provided with a document which neither Ms Sturgeon nor the Authority, at that point, considered to be held by the Authority for the purposes of FOISA. That document was referred to as Document 3 in Decision 102/2020. (In October 2020, after the Applicant made his application to the Commissioner, the Scottish Parliament published Document 3 as Annex B to Ms Sturgeon’s written submission of 4 August 2020, with only a small number of redactions.)

17. Given the Commissioner’s finding regarding Document 3 in Decision 102/2020 (i.e.
that it was held by the Authority for the purposes of FOISA), the Authority reconsidered questions 1 to 10 afresh to ascertain whether Document 3 fell within the scope of any of the requests made by the Applicant and in light of the tests set out in paragraphs 52 to 61 of Decision 102/2020.

18. However, having revisited the searches, particularly those undertaken in response
to the Commissioner’s supplementary questions referred to in paragraph 16, the
Authority was of the view that the searches which had been carried out were sufficiently broad to have captured any information falling with scope of requests 1 to 10. Accordingly, it had not considered it necessary to undertake further searches. (The searches carried out, and whether additional searches were required, are considered in more detail below.)

Request 1: dates, times and meetings of the three publicly stated meetings at which Ms Sturgeon met Mr Salmond

19. The Authority advised the Commissioner that it had interpreted “the three publicly stated meetings” as being the meetings of 2 April, 7 June and 14 July 2018 which Ms Sturgeon set out in her statement to the Scottish Parliament on 8 January 2019. The Official Report of 8 January 2019 records (at column 61):

I met [Mr Salmond] on three occasions: on 2 April 2018 at my home in Glasgow: on 7 June 2018 in Aberdeen, ahead of the Scottish National Party conference; and on 14 July 2018, at my home.

20. The Authority submitted that, insofar as the Applicant sought the dates and locations of these meetings, it was entitled to conclude that the information was otherwise available to the Applicant and exempt from disclosure under section 25(1) of FOISA.

21. Although it had previously indicated that it did not hold the times of the meetings, having reviewed Document 3, it now considered that it held some further information about two of the three meetings. It disclosed this information to the Applicant during the investigation.

Request 2: at whose request were these meetings arranged and were Authority staff involved in any way

22. The Authority commented that it had indicated to the Applicant that some of the information was otherwise available to him, having been published in the Official Report of 10 January 2019:

At the first meeting, my chief of staff was with me and Mr Salmond was represented. Of course, my chief of staff is a special adviser who also has the ability to assist me – [interruption] – in party matters. At the other meetings, no one else was present.

23. The Authority submitted that, insofar as the Applicant asked whether its staff were involved in the meetings (special advisers being temporary civil servants), that it was entitled to conclude that the information was otherwise available to the Applicant and exempt from disclosure under section 25(1) of FOISA.

24. It noted that it had previously indicated that it did not hold the remainder of the information sought in this request (i.e. at whose request or initiative each of the meetings was arranged). However, having reviewed Document 3, it now considered that it did hold information, namely at whose request one of the meetings had been arranged. It disclosed this information to the Applicant during the investigation.

Request 3: the capacity in which Ms Sturgeon met Mr Salmond and the name and role of anyone else present

25. The Authority noted that it had advised the Applicant that some of the information covered by this request was otherwise available to him. The Official Report of 10 January 2019 records (columns 10 and 12 respectively):

Obviously, like other party leaders here, I have responsibilities as leader of my party and I took part in meetings in that capacity.

At the first meeting, my chief of staff was with me and Mr Salmond was represented. Of course, my chief of staff is a special adviser who also has the ability to assist me … in party matters. At the other meetings, no one else was present.

26. The Authority therefore submitted that all of the information in request 3 was in fact otherwise available to the Applicant as it had been published in the Official Report, meaning that it was exempt from disclosure under section 25(1) of FOISA.

Request 4: notes from meetings between Ms Sturgeon and Mr Salmond (unless it compromises the privacy of alleged victims or ongoing legal proceedings)

27. The Ministers confirmed that, having reviewed its original response to this request, it remained its position that it did not hold any information falling within the scope of the request.

Request 5: correspondence arising from the meetings (unless it compromises the privacy of alleged victims or ongoing legal proceedings)

28. The Authority had indicated to the Applicant that some of the information covered by this request, having been published in the Official Report, was exempt from disclosure under section 25(1) of FOISA.

29. In light of Decision 102/2020, it now considered that information in Document 3 fell within scope of this request. It disclosed this information to the Applicant during the investigation, (subject to the redaction of information which is subject to legal professional privilege under section 36(1) of FOISA and of certain third-party data under section 38(1)(b) of FOISA) and provided the Applicant with the published version of the document on the Scottish Parliament’s website.

Request 6: whether these meetings involved any departure from normal policy or procedure in terms of minuting or presence of Scottish Government staff and, if so, at whose direction

30. The Authority had indicated to the Applicant that it did not hold any information falling within the scope of this request. It commented that this request essentially asks for an opinion and, as the Commissioner’s Tips for requesters points out, where a request asks for an opinion, it is unlikely that recorded information will be held.

31. It remained the Authority’s position that it did not hold any information falling within scope of this request.

Request 7: details of other meetings besides those referred to in request 1

32. The Authority noted it had indicated that it did not hold any information falling within scope of this request. Having reconsidered its response, it remained its position that it did not hold any information.

33. It noted that, in October 2020 (after the Applicant had made his application to the Commissioner), it came to its attention that Ms Sturgeon had indicated that she did not have any further meetings with Mr Salmond (Ms Sturgeon’s Written Submission, published by the Scottish Parliament, states that the meeting of 14 July 2018 was her final meeting with Mr Salmond). The Authority brought the Written Submission to the Applicant’s attention during the investigation.

Request 8: other correspondence between Ms Sturgeon and Mr Salmond during 2018

34. The Authority had indicated to the Applicant that it did not hold any information falling with the scope of this request.

35. Having reconsidered its position, it remained of the view that no information was held. (It explained that, given the reference to “other correspondence” in the wording of this particular request, it did not consider Document 3 to fall within scope.)

Request 9: contact between Mr Aberdein and Ms Sturgeon on or around 29 March 2018 concerning inappropriate behaviour by Mr Salmond towards Scottish Government staff or any other women (with the exception of the names of any alleged complainers or victims)

36. The Authority had indicated that it did not hold any information falling within the scope of request 9. Having reconsidered its response, that remained its position.

Request 10: contact between Mr Aberdein and Scottish Government Ministers or staff concerning inappropriate behaviour by Mr Salmond towards Scottish Government staff or any other women (with the exception of the names of any alleged complainers or victims)

37. The Authority had indicated that it did not hold any information falling within the scope of request 10. Having reconsidered its response, it maintained that it was correct to give notice under section 17(1) of FOISA.

38. The Authority was not required to review its response to requests 11 and 12(i) and (ii) during the investigation, as those requests were different from the requests considered in Decision 102/2020). However, given the need to ensure himself that all information covered by these requests was located by the Authority, the Commissioner will consider them here.

Request 11: meetings between Mr Birt and the Authority concerning inappropriate behaviour by Mr Salmond

39. The Authority advised the Applicant that the information it held was exempt from disclosure under section 26(c) of FOISA. (Section 26(c) is considered in more detail below.)

Request 12(i): Change of policy whereby female members of staff not to be alone with Mr Salmond

40. The Authority advised the Applicant that the information was exempt from disclosure under section 26(c) of FOISA.

Request 12(ii): Who would have been privy to the change of policy information

41. The Authority advised the Applicant that the information was exempt from disclosure under section 38(1)(b) of FOISA. (Section 38(1)(b) is considered in more detail below.)

Section 17(1) – Notice that information is not held

42. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.

43. The information to be given is that held by the public authority at the time the request is received, as defined by section 1(4). If no such information is held by the public authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.

44. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the authority to explain why it does not hold the information.

45. As noted above, the Applicant had commented, prior to information being disclosed to him during the investigation, that he found it difficult to believe that the Authority did not hold other information.

Searches

46. The Commissioner asked the Authority to describe what searches it had carried out; which records had been searched and any keywords and other search parameters used.

47. The Authority provided the Commissioner with a copy of the searches template which detailed the searches it had carried out when initially responding to the Applicant (19 June 2000). The template narrates a number of electronic searches carried out in its records management system using a number of terms taken from the Applicant’s request. These searches identified two documents which had already been identified as falling within scope of an earlier request by the Applicant as well as in relation to Decision 102/2020, where they were referred to as Documents 1 and 2.

48. The case handler also reviewed the files for the earlier requests in light of the similar subject matter of the requests. The review did not identify any further information falling within scope.

49. A colleague of the case handler asked the First Minister’s Private Office (FMPO) to undertake searches for information held within and outwith its eRDM. The FMPO advised that no further information within scope had been identified beyond that already identified (i.e. Documents 1 and 2). The searches were re-run when the case handler identified a typographical error in some of the original search terms.

50. Two further civil servants, who had given evidence in the course of the criminal proceedings against Mr Salmond, were asked to carry out searches. That led to two documents being located that fell within the scope of requests 11 and 12.

51. The Authority noted that the case handler was a member of a small team set up to coordinate various matters in connection with the allegations made against Mr Salmond. Among other things, the team had dealt with FOI requests on this and related topics since early 2019, and so members of that team had developed a high level of familiarity with the range of information held by on these topics. This included information held in restricted files which would not otherwise appear in search returns; in this case, the case handler had the necessary permission to access those files and so the searches would have identified information in those files.

52. Having handled a significant volume of requests on these matters, the team had a high level of familiarity with what information was already in the public domain, whether as a result of previous FOI disclosures or otherwise. For example, the team had a detailed knowledge of the statements made by Ms Sturgeon to the Scottish Parliament in January 2019, and would routinely signpost requesters to that publicly available information where their requests were answered by the content of those statements.

53. As noted above, having revisited the searches, particularly those undertaken in response to the Commissioner’s supplementary questions referred to in paragraph 16, the Authority was of the view that the searches which had been carried out were sufficiently broad to have captured any information falling with scope of requests 1 to 12. Accordingly, it had not considered it necessary to undertake further searches.

54. The Commissioner is satisfied that, in the circumstances, the searches already carried out by the Authority were reasonable and would have been capable of identifying any information covered by requests 1 to 12. In coming to this conclusion, he has considered:

The breath of the searches carried out by the Authority (detailed evidence of which were provided to the Commissioner)
The fact that the searches were clearly carried out by the members of staff most likely to be able to locate the information, including a small team who had handled a significant volume of requests for this and related information and which had access to restricted files
The substantial overlap between requests 1 to 10 and the requests which were the subject of Decision 102/2020. The Commissioner was satisfied that, by the end of the investigation which led to Decision 102/2020 (particularly after having required the Authority to carry out additional searches), that it had located all of the information covered by that request.

55. The Commissioner is therefore satisfied, on the balance of probabilities, that the Authority has identified all of the information it holds which falls within the scope of the Applicant’s requests.

56. As noted above, where an authority does not hold information, it is required (except for the limited situations in which it can neither confirm nor deny whether it holds information – section 18 of FOISA) to notify the applicant that it does not hold information. Here, he is satisfied that the Authority was entitled to notify the Applicant, under section 17(1) of FOISA, that it did not hold information in relation to requests 4, 6, 7, 8, 9 and 10.

57. He also finds that the Authority was not entitled to notify the Applicant that it did not hold information in relation to requests 1, 2 and 5. This was a breach of section 1(1) of FOISA. However, the Commissioner notes that, at the time the Authority responded to the Applicant’s requests, it did not consider that Document 3 fell within the scope of the requests and that the Authority changed its approach after Decision 102/2020 was issued.

58. The Commissioner will consider the Authority’s response to requests 1, 2, 3 and 5 below.

Section 25(1) – Information otherwise accessible

59. Information which an applicant can reasonably obtain other than by requesting it under section 1(1) of FOISA is exempt from disclosure. This exemption is not subject to the public interest test in section 2(1)(b) of FOISA (see section 2(2)(a)).

60. The Commissioner has viewed the information which was publicly available to the Applicant in respect of requests 1, 2 and 3 and is satisfied that the information to which the Authority applied the exemption in section 25(1) was, at the time he made his requests, otherwise reasonably obtainable by him. The exemption therefore applies.

61. The Commissioner notes, in respect of request 5, that the Authority advised the Applicant that some of the information it held was exempt under section 25(1) of FOISA. Following the issue of Decision 102/2020, the Authority concluded that it held information which was not otherwise available to the Applicant and disclosed it (subject to redaction) during the investigation. As this information was not otherwise available to the Applicant, it was not exempt under section 25(1) of FOISA. Again, the Commissioner notes that, at the time the Authority responded to the Applicant’s requests, it did not consider that Document 3 fell within the scope of the requests and that the Authority changed its approach after Decision 102/2020 was issued.

Section 26(c) - Prohibitions on disclosure

62. Under section 26(c) of FOISA, information is exempt information if its disclosure by a Scottish public authority (otherwise than under FOISA) would constitute, or be punishable as, a contempt of court.

63. This exemption is not subject to the public interest test in section 2(1)(b) of FOISA (see section 2(2)(b)).

64. The Authority applied the exemption in section 26(c) to information falling with scope of:

Request 11: meetings between Mr Birt and the Authority concerning inappropriate behaviour by Mr Salmond towards Authority staff or any other women (with the exception of the names of any alleged complainers or victims)
Request 12(i): Information concerning a change of policy or practice whereby female members of Authority staff were not to be alone with Mr Salmond

Judicial review proceedings and the civil order

65. On 29 August 2018, Mr Salmond commenced judicial review proceedings against the Authority, challenging the handling of certain complaints that had been made against him.

66. On 8 October 2018, Lord Woolman made an order under section 11 of the 1981 Act (“the civil order”) in relation to these proceedings. The order was in the following terms:

The Lord Ordinary … makes an order in terms of Chapter 102.3(5) of the Rules of Court withholding from the public in these proceedings the names and the designations, past and present, of the complainers referred to in the decision report which is the subject matter of this petition and any other information concerning those complainers which would lead to their identification; orders, in terms of section 11 of the Contempt of Court Act 1981, that no publication by any means, including on social media, of any of the aforementioned information relating to the complainers, be made …

67. Mr Salmond and the Authority subsequently entered into a Joint Minute which brought the judicial review proceedings to a conclusion on 8 January 2019. As part of this, the Authority gave the following undertaking:

Save insofar as necessary to comply with any lawful requirement, to co-operate with any criminal investigation, or as may otherwise be approved by the Court, the [Authority] will not cause or permit the publication or dissemination to any other person of the said Investigating Officer’s report or any of the statements or other material taken or prepared by her in the course of preparing same.

68. The Authority noted that, where such an undertaking is given, a failure to take reasonable steps to ensure that the undertaking is adhered to, if that failure is so gross as to demonstrate a disregard for the importance which should have been attached to the undertaking, would constitute a contempt of court (William Beggs v the Scottish Ministers at paragraph 46).

69. The Authority noted that, although the judicial review proceedings have been concluded, the civil order continued (and continues) to have effect.

Criminal proceedings and the criminal order

70. On 24 January 2019, Mr Salmond appeared in court charged with a number of offences. Around this time, both Police Scotland and the Crown Office and Procurator Fiscal Service issued reminders to the public that proceedings were therefore “live” for the purposes of the 1981 Act.

71. Mr Salmond went on trial at the High Court at Edinburgh on 9 March 2020.

72. On 10 March 2020, the Lord Justice Clerk made an order at common law and under section 11 of the 1981 Act preventing the publication of the names and identity and any information likely to disclose the identity of the complainers in that case (the criminal order).

73. Mr Salmond was acquitted of the charges against him on 23 March 2020.

74. The order made on 10 March 2020 was varied by the Lord Justice Clerk on 11 February 2021 so that it prevented:

the publication of the names and identity and any information likely to disclose the identity of the complainers … as such complainers in those proceedings

Would disclosure breach the orders?

75. It is clear that both the civil and criminal orders remain in place and were, subject to the minor variation to the criminal order in February 2021, both in place at the time the Applicant made his information requests.

76. It is also clear that, were the Authority to disclose any information contrary to the court orders, this would constitute, or be punishable as, a contempt of court and that the information would be exempt from disclosure under section 26(c) of FOISA. As can be seen from the way in which the Applicant drafted a number of his requests (some requests specifically exclude “the names of any alleged complainers or victims”), it is clear that he was aware of the sensitivity of the information. However, he was concerned that the exemption had been applied too broadly by the Authority and that it had, in effect, withheld under this exemption information which would not identify or disclose the identity of the complainers.

77. While the Authority acknowledged that the Applicant has asked for the names or an alleged complainers or victims to be redacted (and that this information was therefore outwith the scope of the request), it noted that the civil and criminal orders (respectively) prohibit the disclosure of a wider range of information, i.e.:

other information concerning these complainers which would lead to their identification

and

any information likely to disclose the identity of the complainers

78. As noted above, the Commissioner is unable to set out his reasoning in full because of the need, particularly in the light of the civil and criminal orders, not to disclose, even accidentally, information which could of itself lead to the identification of the complainers.

79. The Authority referred the Commissioner to the approach he took has taken in Decision 125/2019, which involved a request for anonymised copies of the complaints made against Mr Salmond. In that case, the Commissioner was satisfied that it would not be possible to anonymise the complaints such that there would be no realistic prospect of identifying the complainers.

80. Having viewed the information withheld under section 26(c) here, the Commissioner is satisfied that it contains a large amount of information which could, for reasons given the Authority, lead to the complainers being identified. The Commissioner is aware that he must consider all of the means reasonably likely to be used by third parties to identify the individuals in question. The amount of speculation as to the identities of the complainers, particularly given the high profile of Mr Salmond, means that any information disclosed from the complaints is highly likely to be scrutinised, in conjunction with other information already in the public domain, in an attempt to identify the individuals.

81. The effect of taking out anything which would realistically identify the individuals would, in the Commissioner's view, lead to the remainder of the information being unintelligible or of no practical use to the Applicant in answering the questions he has put to the Authority. The Commissioner is therefore satisfied that the document cannot be anonymised.

82. In coming to this view, the Commissioner took account of the 2016 judgment of the First Tier Tribunal (Information Rights) in Paul Boam and the Information Commissioner and Ofsted. In that case, the Tribunal accepted that there are limits to reasonable redaction, for example in cases where:

the excisions required for anonymisation must be so drastic that what remains in incoherent or even meaningless" meaning that it is reasonable to redact entire documents.

83. The Commissioner is therefore satisfied that the Authority was entitled to apply
the exemption in section 26(c).

Section 36(1) – Confidentiality

84. The Authority relied on section 36(1) to withhold legal advice.

85. Section 36(1) of FOISA exempts from disclosure information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.

Legal advice privilege

86. One type of communication covered by this exemption is that to which legal advice privilege, a form of legal professional privilege, applies. Legal advice privilege covers communications between lawyers and their clients in the course of which legal advice is sought or given. For legal advice privilege to apply, certain conditions must be fulfilled:

the communications must involve a professional legal adviser, such as a solicitor or an advocate. This may include an in-house legal adviser or an external solicitor engaged by the Authority;
the legal adviser must be acting in his/her professional capacity; and
the communications must occur in the context of the legal adviser's professional relationship with his/her client.

87. The Commissioner is satisfied that the information relates directly to seeking and obtaining legal advice from a professional legal adviser, acting in that capacity.

88. Information cannot be privileged unless it is also confidential. It must be information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings. The claim must be capable of being sustained at the time the exemption is claimed: the information must possess the quality of confidence at that time, and so cannot have been made public, either in full or in a summary substantially reflecting the whole.

89. The Commissioner is satisfied that the withheld information remained confidential at the time the Authority responded to the Applicant's information request and requirement for review (and that it remains so now).

Public interest test

90. The exemption in section 36(1) is a qualified exemption, which means that its application is subject to the public interest test set out in section 2(1)(b) of FOISA. Having decided that the information is exempt under section 36(1), the Commissioner must go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.

91. The Applicant argued that the public interest lay in disclosing the information. He commented that the questions raised by this affair are among the most grave and serious which can be levelled against any government involving, for example:

the alleged harassment of civil service staff by a First Minister
the mishandling of allegations and
pressure apparently being placed on individuals to ensure alleged behaviour was
not revealed or not confronted during an important political period.

92. The Applicant also questioned whether key meetings and events had deliberately not been minuted, contrary to Ministerial and civil service rules, with an apparent view to ensuring that the alleged behaviour remained covered up, or not appropriately dealt with.

93. In the Applicant’s view, this is even more serious than, for example, the Shirley McKie case (a reference to Decision 109/2010, where the Commissioner ordered the Authority to disclose some information which had been withheld under section 36(1) on public interest grounds), given that this matter concerns the role and potential involvement of actual Scottish Government Ministers (including at least two First Ministers) and its most senior civil servants.

94. The Applicant also commented that, in a democracy where Ministers by definition cannot be above scrutiny and rule of law, particularly on matters as serious as these, the balance of public interest overwhelmingly lies in disclosure, while ensuring the anonymity of any alleged victims.

95. The Commissioner acknowledges the public interest in the transparency and accountability expected of all authorities, and that disclosure of the information would go some way towards providing that transparency and accountability.

96. Nevertheless, there is a strong inherent public interest, recognised by the courts, in maintaining the right to confidentiality of communications between legal adviser and client on administration of justice grounds. In a Freedom of Information context, the strong inherent public interest in maintaining legal professional privilege was emphasised by the High Court (of England and Wales) in the case of Department for Business Enterprise & Regulatory Reform v O'Brien & Anor. Generally, the Commissioner will consider the High Court's reasoning to be relevant to the application of section 36(1) of FOISA.

97. The Commissioner acknowledges that there will be occasions where the significant public interest in favour of withholding legally privileged communications may be outweighed by a compelling public interest in disclosing the information.

98. However, having considered the actual advice in question. the Commissioner finds, in the circumstances of this particular case, that there is a stronger public interest in protecting the confidentiality of the information.

99. On balance, the Commissioner is not satisfied that the public interest in disclosure of this particular information is sufficiently compelling to outweigh the strong public interest in maintaining the confidentiality of communications between legal adviser and client. He has reached this conclusion bearing in mind the importance attached by the courts to maintaining confidentiality of communications on administration of justice grounds.

100. Consequently, he accepts that the Authority correctly withheld the withheld legal advice contained in under section 36(1) of FOISA.

Section 38(1)(b) – Personal information

101. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.

102. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

103. In order to rely on this exemption, the Authority must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.

104. The Authority relied on section 38(1)(b) in responding to the following:

Request 5: correspondence arising from the meetings (unless it compromises the privacy of alleged victims or ongoing legal proceedings)

Request 12(ii): who would have been privy to a change in policy or practice where female members of Authority staff were not to be alone with Mr Salmond

Is the withheld information personal data?

105. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. (The definition of “personal data” is set out in full in Appendix 1.)

106. The two main elements of personal data are that:

the information must “relate to” a living person; and
the living individual must be identifiable.

107. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

108. An “identifiable living individual” is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

109. The Commissioner is satisfied that the information being withheld under section 38(1)(b) is personal data: the information withheld in response to request 5 comprises a direct telephone number and email address for a named person and, for request 12(i), the names of staff who would have been privy to a change in policy or practice. Living individuals are identifiable from this information and the information clearly relates to those individuals.

Would disclosure contravene one of the data protection principles?

110. The Authority argued that disclosure would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”

111. "Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.

112. The Commissioner must consider whether disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.

113. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

114. Condition (f) states that processing shall be lawful if it is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

115. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

116. The three tests which must be met before Article 6(1)(f) can be met are as follows:

Does the Applicant have a legitimate interest in the personal data?
If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data?

117. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subjects before condition (f) will permit the data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Authority was correct to refuse to disclose the personal data to the Applicant.

Does the Applicant have a legitimate interest?

118. The Authority accepted that the Applicant had a legitimate interest in understanding who was privy to information about a change of policy or practice whereby female members of staff were not to be alone with Mr Salmond, particularly given the wider public interest in understanding how the Authority responded to allegations made against Mr Salmond.

119. The Commissioner agrees that the Applicant has a legitimate interest in the information for the same reasons as those given by the Authority.

120. However, the Commissioner does not consider that the Applicant has a legitimate interest in the disclosure of the contact details of the named person in response to request 5 as they do not have any bearing on the wider issues here. In the absence of a legitimate interest, the Commissioner will not go on to consider whether disclosure of the contact details is necessary or to balance the Applicant’s legitimate interests against those of the data subject. He will, however, go on to consider those tests in relation to the Authority’s response to request 12(i).

Is disclosure necessary to achieve that legitimate interest?

121. The Authority accepted that there were no other means by which the Applicant’s
legitimate interests could be met while interfering less with the privacy of the data subject(s): it is not possible to meet those legitimate interests otherwise than by disclosing the name(s).

122. Similarly, the Commissioner can identify no other viable means of meeting the Applicant’s legitimate interests than providing the withheld information. He is therefore satisfied that, in all the circumstances of the case, disclosure of the information is necessary for the purposes of the Applicant’s legitimate interests.

Balancing the Applicant’e legitimate interests and those of the data subject(s)

123. Having found that disclosure is necessary for the purposes of the Applicant’s legitimate interests, the Commissioner must now balance the legitimate interests in disclosure against the individual’s/individuals’ interests or fundamental rights and freedoms.

124. The Commissioner’s guidance on section 38 of FOISA lists certain factors that should be taken into account in balancing the interests of the parties. He makes it clear that, in line with Recital (47) of the General Data Protection Regulation, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:

Does the information relate to an individual’s public life (their work as a public official or employee) or their private life (their home, family, social life or finances)?
Would disclosure cause harm or distress?
Whether the individual has objected to the disclosure.

125. As noted above, disclosure under FOISA is public disclosure; information disclosed under FOISA is effectively placed into the public domain.

126. The Authority considered that the interests and fundamental rights and freedoms of the data subjects outweigh the interests of the Applicant for, amongst others which the Commissioner is unable to detail, the following reasons:

The information concerns a staff matter of some considerable sensitivity and, in this context, they would have a general expectation of confidentiality or privacy. The Authority contrasted this with a member of staff who has a public-facing role as the lead official on a particular policy, where there would correspondingly be less of an expectation of privacy in connection with that work.
Given the wider context surrounding the allegations made against Mr Salmond, and the very considerable public discourse that has taken place in connection with the judicia review proceedings, the criminal proceedings and subsequently the various inquiries and investigations, the Authority also considered that disclosure is likely to cause distress to the data subject(s) by virtue of the level of public attention likely to result from disclosure

127. After carefully balancing the legitimate interests of the data subject(s) against those of the Applicant, the Commissioner finds that the balance of legitimate interests falls in favour of the data subject(s). The Commissioner recognises the level of public attention which would result from (and the considerable public discourse likely to arise as a result of) the disclosure and is satisfied that the level of distress or damage this would cause would outweigh the Applicant’s legitimate interests in the information.

128. Having found that the legitimate interests served by disclosure of the personal data are outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subject(s), the Commissioner finds that condition (f) in Article 6(1) of the GDPR cannot be met and that disclosure would be unlawful.

129. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data is otherwise be fair and transparent in relation to the data subject(s).

130. The Commissioner is therefore satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful. The personal data is therefore exempt from disclosure under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Authority generally complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information requests made by the Applicant.

However, in advising the Applicant (i) that it did not hold information falling within the scope of certain requests and (ii) that certain information was otherwise accessible to the Applicant, he finds that the Authority failed to comply with section 1(1) of FOISA.

Given the action taken by the Authority during the investigation, the Commissioner does not require it to take any action in respect of these failures.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Daren Fitzhenry
Scottish Information Commissioner

30 August 2023

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the
information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part

2 (and no others) are to be regarded as conferring absolute exemption –

(a) section 25;

(b) section 26;

…

(e) in subsection (1) of section 38 –

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

…

25 Information otherwise accessible

(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.

…

26 Prohibitions on disclosure

Information is exempt information if its disclosure by a Scottish public authority (otherwise than under this Act)-

…
(c) would constitute, or be punishable as, a contempt of court.

36 Confidentiality

(1) Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections
(2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018
(manual unstructured data held by public authorities) were disregarded.

…

(5) In this section-
"the data protection principles" means the principles set out in –

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of
that Act);

…

“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

47 Application for decision by Commissioner

(1) A person who is dissatisfied with -

(a) a notice under section 21(5) or (9); or

(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.

may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.

(2) An application under subsection (1) must -

(a) be in writing or in another form which, by reason of its having some permanency, is
capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);

(b) state the name of the applicant and an address for correspondence; and

(i) the request for information to which the requirement for review relates;

(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and

(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).

…

Contempt of Court Act 1981

11 Publication of matters exempted from disclosure in court

In any case where a court (having power to do so) allows a name or other matter to be withheld from the public in proceedings before the court, the court may give such directions prohibiting the publication of that name or matter in connection with the proceedings as appear to the court to be necessary for the purpose for which it was so withheld.

UK General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the
following applies:

…

f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the
individual.

(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of
information, such as –

…

(d) disclosure by transmission, dissemination or otherwise making available,

…

(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

…

(14) In Parts 5 to 7, except where otherwise provided –

(a) references to the UK GDPR are to the UK GDPR read with Part 2;

…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;

(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.

Appendix 2: The information requests

1. Dates, times and locations of the three publicly stated meetings at which [Nicola Sturgeon] met Alex Salmond in relation to complaints against him of inappropriate
behaviour towards Scottish Government staff.

2. At whose request or initiative each of those meetings referred to above were arranged and if Scottish Government staff were involved in any way in their arrangement, during them or in their follow-up.

3. The capacity Ms Sturgeon met Mr Salmond in the three meetings referred to above and the name and role of anyone else present on each occasion.

4. If any minutes or other notes were taken at the meetings referred to above and if so,
information contained in those documents except for any information which compromises the privacy of alleged victims or ongoing legal proceedings.

5. Information contained in any correspondence (including to or from [Ms Sturgeon] and Mr Salmond) arising from the meetings referred to above except for any information which compromises the privacy of alleged victims or ongoing legal proceedings.

6. Whether the meetings referred to above involved any departure from normal policy or procedure in terms of minuting or presence of Scottish Government staff and if so, at whose direction this was.

7. If there have been any recorded meetings besides the three referred to above between [Ms Sturgeon] and Mr Salmond during 2018 on any subject and if so their dates, times, locations, matters discussed and information contained in any minutes, associated notes or correspondence.

8. Information contained in any other correspondence between [Ms Sturgeon] and Mr Salmond or issued to Mr Salmond on the First Minister's behalf during 2018.

9. Information contained in correspondence minutes, meeting notes or any record of contact including meeting locations where known between Geoff Aberdein and [Ms Sturgeon] on or around 29 March 2018 concerning inappropriate behaviour by Alex Salmond towards Scottish Government staff or any other women removing names of any alleged complainers or victims where applicable.

10. Information contained in correspondence, minutes, meeting notes or any record of contact including meeting locations where known between Geoff Aberdein and Scottish Government Ministers or staff concerning inappropriate behaviour by Alex Salmond towards Scottish Government staff or any other women removing names of any alleged complainers or victims where applicable.

11. Information contained in correspondence, minutes, meeting notes or any record of contact including meeting locations where known between Chris Birt and Scottish Government Ministers or staff concerning inappropriate behaviour by Alex Salmond towards Scottish Government staff or any other women removing names of any alleged complainers or victims where applicable.

12. (i) Information contained in correspondence or any record concerning a change of policy or practice whereby female members of Scottish Government staff were not to be alone with Alex Salmond and (ii) who would have been privy to this information.